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Further specifying procedural rules relating to the 
enforcement of the General Data Protection 
Regulation 


FEDMA is pleased to provide its input to the European Commission's Call for Evidence on an initiative 


on procedural aspects of the GDPR. 


Over almost five years of GDPR implementation, Data Protection Authorities (DPAs) have made full 
use of the margin of manoeuvre available under the text. However, the resulting fragmentation is not 
only due to diverging national interpretation and guidance on the GDPR, but also differences in 
national legislations. The objective of the Commission must be to address both points, including as 


required a modification of the text of the GDPR. 


The lack of EU harmonised administrative procedures to handle cross-border cases — including the 
position of the parties in the proceedings, admissibility criteria, transparency duration of proceedings, 
deadlines, possibility to share confidential information with other DPAs and with the parties 
undergoing the investigation, right to be heard etc. - and different interpretations relating to the 
cooperation mechanism jeopardise the consistent application and enforcement of the GDPR from 
the perspective of a Digital Single Market. More importantly, they jeopardise due process and the 


fundamental right to a fair trial, which are the cornerstones of our democratic societies. 


Next to reiterate the importance on addressing the fragmented interpretation of the GDPR, we also 
support the Commission’s objective to harmonise some aspects of the administrative procedure the 
DPAs apply in cross-border cases. However, on top of supporting the different high-level policy 


options outlined in the Call for Evidence, FEDMA recommends: 


e conducting a study to identify all divergences in national procedural laws and the impact of 
different approaches on the application and enforcement of the GDPR. This would help to 
narrow down the areas of procedural laws that require the most urgent harmonization and 
where a harmonized approach could provide the most benefits to DPAs, the parties undergoing 
an investigation and as the case may be complainants. As different legal traditions across the 
EU stem from cultural and strategic differences, the Study would also contribute to foster mutual 
understanding of these traditions among national authorities in order to facilitate the 


harmonisation process. 


e =centralising information on all national procedural laws applicable to parties under investigation 
at EU level through the EDPB’s or the Commission's website. Though these aspects of procedural 


law could eventually be harmonised, a single point of reference for the provision of this 
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information would be extremely useful, especially in cross-border case, for the parties under 
investigation to be aware of the details on the process, the right to be heard, deadlines at all 


stages of the procedure, including timelines and opportunities for full answer and defense. 


e providing the parties under investigation with information on any relevant and reasoned 
objections made to a proposed decision, including where appropriate relevant interactions 
between the DPAs, as well as with the opportunity to be heard vis-à-vis the EDPB, especially in 


case of pending fines or sanctions. 


e Providing the party under investigation with the draft decision taken by the lead DPA when it is 


circulated to the concerned DPAs. 


e Providing the party under investigation with the details of the contacts at the DPAs that have 
declared themselves as concerned authorities to enable the party under investigation to 
contact the concerned DPAs and to present their observation (right to be heard) before the 


DPA can decide to raise or not to raise relevant and reasoned objections. 


e including strict deadlines that the leading DPA in a cross-border case must comply with when 
answering investigation and enforcement requests from other concerned DPAs or the EDPB. This 
would replicate part of the design of the Digital Services Act (DSA)’s first enforcement layer, 


ensuring that decisions are delivered within months. 


e streamlining the processes and requirements for the adoption of Codes of Conduct as a tool to 
enhance GDPR application and enforcement. In particular, we believe that the substantive 
assessment of the candidate code of conduct should be made by the EDPB and the European 
Commission simultaneously as part of a single procedure, rather than having to face a doubling 
of the procedures that may discourage candidates from considering codes of conduct. 
Enhancing the adoption of Codes of Conduct has also the potential to enable resource savings 
at both the national and EDPB level. 
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